Landmark enforcement action marks first FMI penalty given by BoE under Banking Act powers
The Bank of England has fined payments giant Vocalink $16.2 million (£11.9m) for failing to comply with a supervisory direction, the first time it has issued a financial penalty to a financial market infrastructure (FMI) provider.
Vocalink, which designs and operates core UK payments infrastructure including Bacs, Faster Payments and LINK, was found to have breached a direction issued under section 191 of the Banking Act 2009.
The BoE concluded that the Mastercard-owned firm did not meet the requirements by the regulatory deadline of 28 February 2022.
The original fine was set at £20 million but was reduced by 45% due to Vocalink’s cooperation, early admission of failings, and agreement to settle the matter.
According to the BoE’s statement published on July 9, the enforcement action follows a 2020 review that uncovered weaknesses in Vocalink’s systems, controls and governance arrangements.
These concerns prompted the BoE to issue a formal direction requiring the company to undertake a remediation programme.
While Vocalink launched a programme to address the identified risks, the BoE’s investigation found the firm failed to implement a sufficiently integrated risk management framework and did not adequately escalate critical information to its senior governance committees.
An external assurance report which raised concerns over the remediation programme was not escalated to the Board before the firm’s declaration of compliance. When the report eventually surfaced, Vocalink acknowledged that its confirmation to the BoE would not have been made had the Board been aware of the findings.
“Vocalink fell short of its obligation to have adequate risk management and governance arrangements when responding to the Bank’s Direction,” said Sarah Breeden, Deputy Governor for Financial Stability.
“Its failure to comply with that Direction in full has resulted in a significant fine.”
Within the scope of power
Vocalink has been regulated by the BoE as a “specified service provider” since 2018. These providers deliver essential services to payment systems designated as systemically important by HM Treasury.
The BoE’s remit includes the supervision of central counterparties, central securities depositories, recognised payment systems, and their specified service providers, under the broader objective of maintaining UK financial stability.
According to its supervisory framework, the BoE may issue legally binding directions to FMI firms where serious deficiencies are identified. It expects such firms to maintain robust risk management, effective governance and clear escalation procedures, particularly when operating infrastructure that supports the UK’s financial system.
In its final notice, the BoE said Vocalink’s failings undermined the purpose of the supervisory direction and fell below the standards expected. It emphasised the importance of integrated risk oversight across all three lines of defence and clear communication between business areas, risk functions, internal audit and the Board.
While the BoE noted that Vocalink has since made significant investments in addressing the issues, it chose to proceed with enforcement to reflect the seriousness of the compliance failure.
The fine is the first issued by the Bank to an FMI under its enforcement powers. It follows the publication of its 2024 enforcement approach and is expected to serve as a precedent for future supervisory interventions within the UK’s critical payments infrastructure landscape.
